From 819b34b554096283e92fbb5962a9e7e9579d2456 Mon Sep 17 00:00:00 2001 From: Robert Scott Date: Sat, 6 May 2023 22:30:42 +0100 Subject: [PATCH] connman: add patch for CVE-2023-28488 (cherry picked from commit 6936f33c1b09332ee7c33b4afdd61cc443d2abf1) --- pkgs/tools/networking/connman/connman/default.nix | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/pkgs/tools/networking/connman/connman/default.nix b/pkgs/tools/networking/connman/connman/default.nix index bfe609f85268..d729879b07f5 100644 --- a/pkgs/tools/networking/connman/connman/default.nix +++ b/pkgs/tools/networking/connman/connman/default.nix @@ -62,7 +62,13 @@ stdenv.mkDerivation rec { sha256 = "sha256-eftA9P3VUwxFqo5ZL7Froj02dPOpjPELiaZXbxmN5Yk="; }; - patches = lib.optionals stdenv.hostPlatform.isMusl [ + patches = [ + (fetchpatch { + name = "CVE-2023-28488.patch"; + url = "https://git.kernel.org/pub/scm/network/connman/connman.git/patch/?id=99e2c16ea1cced34a5dc450d76287a1c3e762138"; + sha256 = "sha256-377CmsECji2w/c4bZXR+TxzTB7Lce0yo7KdK1oWfCVY="; + }) + ] ++ lib.optionals stdenv.hostPlatform.isMusl [ # Fix Musl build by avoiding a Glibc-only API. (fetchpatch { url = "https://git.alpinelinux.org/aports/plain/community/connman/libresolv.patch?id=e393ea84386878cbde3cccadd36a30396e357d1e";